CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 27, 2026, saying it has evidence that all three are being used in real attacks. One of them was disclosed in 2023 and is apparently still worth an attacker's time.
The additions, published in CISA's alert, are CVE-2023-49105 in ownCloud, CVE-2026-53362 in the Linux kernel, and CVE-2026-66384 in JFrog Artifactory. The catalog entries carry no CVSS severity scores and the agency publishes no exploitation detail, so the vendor advisories remain the place to look for how each flaw actually works.
A 2023 bug still worth exploiting
CVE-2023-49105 is an improper authentication flaw in ownCloud, the self-hosted file sync and share platform that many organizations run instead of a commercial cloud drive. CISA's description is specific: an attacker can access, modify or delete any file without authenticating, as long as the victim's username is known and that victim has no signing key configured. Both conditions matter. This is not a spray and pray bug, it is one that pays off against a target somebody has already picked.
Its EPSS score, the statistical estimate of how likely a vulnerability is to be exploited in the next 30 days, sits around 11%, against roughly 0.3% for each of the other two additions. Of the three, that was the estimate closest to what CISA is now reporting.
A kernel path and a build server
CVE-2026-53362 is listed only as an unspecified Linux kernel vulnerability that allows privilege escalation through the IPv6 networking subsystem. CISA notes it can affect multiple products, naming SUSE and Red Hat while explicitly not limiting the list to them. Unspecified is the agency's own word, and there is no public mechanism to describe beyond that, so treat any confident account of how this one works with suspicion until a distribution advisory says otherwise.
CVE-2026-66384 is a path traversal issue in JFrog Artifactory, the binary repository that sits in the middle of a great many software build pipelines. CISA describes it as letting an authenticated user write data outside the intended Docker cache path under specific conditions. Write access on the machine that stores an organization's build artifacts is worth considerably more than the "authenticated user" precondition makes it sound, because that machine feeds everything downstream of it.
Federal agencies are on the clock
Binding Operational Directive 26-04 sets what happens next. It requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation, while deferring lower-risk work, and it sets expectations for checking whether an intruder got in before the patch was applied. That last part is the one most private organizations skip. CISA encourages everyone outside the federal government to work the same way.
Older entries keep arriving: nearly a third of July's exploited bugs predated 2025, and the ownCloud flaw continues that pattern. The catalog is not a feed of new bugs, it is a feed of bugs that still work, and the deadlines attached to it have been getting shorter.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.